TASK FORCE ON CLIMATE-RELATED FINANCIAL DISCLOSURES 33 We utilize a Risk Rating Methodology throughout the OPERATIONAL RISK MANAGEMENT RISK APPETITE STATEMENT company in order to provide business owners with a Operational risk is defined as the risk of loss resulting The Board of Directors of the Company and senior systematic way of prioritizing risks such that the most from inadequate or failed internal processes, people, management have approved a Risk Appetite Statement to critical exposures to the business function are easily and systems or from external events. reflect the Company’s core business mission, principles, identifiable. This information allows the business to values, and strategic vision, all working in concert to help ensure appropriate activities, such as risk mitigation or The Company has instituted a Three Lines of Defense achieve our corporate purpose of creating opportunities resource allocation, are taken into consideration when model that outlines the risk management roles and for communities and people. Risk taking is a fundamental managing its risk environment. responsibilities among frontline business owners, characteristic of providing financial services and is independent risk management functions and inherent in every transaction we undertake. The risk Managing Climate-related Risks independent assurance functions. The operating appetite statement is a comprehensive enterprise effectiveness of a line of defense is enhanced by document that helps establish the tone for the Company’s ENTERPRISE RISK MANAGEMENT the effectiveness of the respective lines’ monitoring risk-taking activities. and oversight in an overlapping and interdependent ERM is the Company’s process to provide reasonable relationship. assurance regarding the achievement of its objectives while managing risk within its risk appetite. ERM Senior management is responsible for supporting each leverages the Company’s risk governance framework to of the lines of defense and including appropriate leaders provide visibility into the Company’s corporate risk profile from the independent risk and assurance functions in to help inform decision-making by management and the significant organizational changes or developments. Board Risk Committee. ERM also ensures the Company’s Independent risk management and assurance functions risk governance framework continues to mature with will coordinate with each other, work closely with business its internal and external business environment through owners, and communicate timely with the committee continuous improvement. Enterprise Risk Administration structure to help ensure an effective and efficient risk oversees and governs the ERM process and is part of the governance framework. second line of defense. The Company has four ERM objectives: • Enhance strategic thinking and planning to identify pertinent opportunities and threats • Improve risk-adjusted decision-making • Spread risk awareness and embed risk management practices throughout the Company • Enhance credibility with key stakeholders— directors, shareholders, associates and regulators